320783b0e2e83b3816c2959530c24ff378d1c75bda3d4caeb18f6993edd4c30b

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client.exe
Size 25.7MB
Sample261001-y64e1abc32
SHA256 320783b0e2e83b3816c2959530c24ff378d1c75bda3d4caeb18f6993edd4c30b
MD5 ad1f2b91d31bde5eec3910ead5161ec9
SHA1 f310590a7b13edd7fc565e66e2f2d53313a493aa
SHA512 490da85a892287bb4214da22ed06639da46b31f7afbedf5b661751c1ee0e9f8c3e64518ec1bfbf441ba436bf671c15729a76078a31eddb3f4a280c49018a7322
SSDEEP 12288:RMy+ScOkwUvttcmd7FCAy03N8KO5E5xTlXXfAWqH49pB5+d:VcvwUvwmZFw0yKOW5ffAEpn+d
TLSH
T1A3476D26ABA800FDE177D1B8CA535903FBB1B84643346ADF03905A661F177D89E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4208	chrome.exe
2884	chrome.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	client.exe
Token: SeDebugPrivilege	4488	client.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4208	4488	client.exe	89
PID 4488 wrote to memory of 2884	4488	client.exe	92

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --disable-extensions --disable-software-rasterizer
  2⤵
  - Loads dropped DLL
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --disable-extensions --disable-software-rasterizer
  2⤵
  - Loads dropped DLL
  PID:2884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bst_4488_1.db

Path C:\Users\Admin\AppData\Local\Temp\bst_4488_1.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bst_4488_10.db

Path C:\Users\Admin\AppData\Local\Temp\bst_4488_10.db
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bst_4488_11.db

Path C:\Users\Admin\AppData\Local\Temp\bst_4488_11.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bst_4488_11.db-shm

Path C:\Users\Admin\AppData\Local\Temp\bst_4488_11.db-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

bst_4488_8.db

Path C:\Users\Admin\AppData\Local\Temp\bst_4488_8.db
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bst_4488_9.db

Path C:\Users\Admin\AppData\Local\Temp\bst_4488_9.db
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2rt_abe_0.dll

Path C:\Users\Admin\AppData\Local\Temp\c2rt_abe_0.dll
Size 122KB
SHA256 c483a6baf2e59425a4fd84071361720fe1bedc55d4a0dec2d9f5844912c3f4d3
MD5 28e87d31afa59361fd818dc5b0733fe7
SHA1 322a8a53778c9ee49ad434a2f035da1195689d41
SHA512 0c997657be60cacd201620a3b85a2ddfd4443d5e6ad2cffa7a312c41e680074517f91f00b536c676274b74368df557ebfb6a89bbdeed9d3714821feb91c3cd89
SSDEEP 3072:gWAzzF1Zye4lkKQ2wQjdHLkw96ilx79YXu:gWAFAWF+dH4B
TLSH
T12DC34B47B3E940BBE5778279C4A30A06E776B8155771ABEF03A0425A1F237E48D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2rt_abe_in_0.bin

Path C:\Users\Admin\AppData\Local\Temp\c2rt_abe_in_0.bin
Size 645B
SHA256 c6c4ee20a155daa81e40a0cc1e37d0263ed3eedc362b4894514c190ce198195d
MD5 885195157a8f29a0c8f693d52cddfa10
SHA1 3a38fd60cff6e5f2eba3efd246ff5b211d14ce98
SHA512 ae164859a151809224d678413b5bc3069ce267996a7c5df004976feb786e7c7c165a11066a126dba147ac07db3c9621b6e00a3f34cae205b39c69b8ae9b7eec4
TLSH
T1B6F0234CC1B400C1D15113B4AB67071A49C9B18ED57B4805949993C8F432044855DF29
MD5 SHA1 SHA512 TLSH

Submit Download

c2rt_abe_out_0.bin

Path C:\Users\Admin\AppData\Local\Temp\c2rt_abe_out_0.bin
Size 32B
SHA256 40f15c23b655d146a4241b5d0d0e6ebac54e52c97e98d749ebf5ea1cc1868b42
MD5 be22603fb9fe2a6f0edd1b34a305a6bd
SHA1 10c7dd03c83ef69f09b59eb77f6f28d3817761e5
SHA512 1905d8bd9702a83ba8244aeef273342cd4150a7ddce491e3b190553c2929fa4a11113776688bbf6588aee9cc1b313dba88c02afcf8a1afbd7a4df614e6345ab1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads